dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd

Analysis

max time kernel
108s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
Size

468KB
MD5

b0d0d666e00c808a8d036c3636da296b
SHA1

7ed3d81cac4092d70b203521f70d640a99f09f83
SHA256

dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd
SHA512

cf3d7241249aee8d9f656e61bfaaccd59fdf4d55255b699dec8a1c55e1416f9501434badf2bcf2ae1e3f6cc81218757f146431f8e5f70d16a669dfae771b4af7
SSDEEP

3072:4belogxaGd5gtbYZPzcfmbfD/n2DnsIH/QmyeQVUA2Qokqi3u87lj:4b4oUbgtCP4fmbfra1a2QRh3u8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2584	Unicorn-22658.exe
2804	Unicorn-15689.exe
2868	Unicorn-20327.exe
2668	Unicorn-32191.exe
2884	Unicorn-46481.exe
2828	Unicorn-52611.exe
2708	Unicorn-32745.exe
3056	Unicorn-53846.exe
3032	Unicorn-39408.exe
2520	Unicorn-30494.exe
608	Unicorn-1448.exe
268	Unicorn-1713.exe
288	Unicorn-61120.exe
2560	Unicorn-1713.exe
1692	Unicorn-47385.exe
816	Unicorn-5844.exe
1752	Unicorn-59684.exe
584	Unicorn-3104.exe
2100	Unicorn-56197.exe
2372	Unicorn-50067.exe
2052	Unicorn-39154.exe
1632	Unicorn-30240.exe
3036	Unicorn-64950.exe
2648	Unicorn-5543.exe
1732	Unicorn-3550.exe
1920	Unicorn-35403.exe
1452	Unicorn-35668.exe
992	Unicorn-31584.exe
1668	Unicorn-47158.exe
2632	Unicorn-40306.exe
3040	Unicorn-11630.exe
2524	Unicorn-7354.exe
1624	Unicorn-28521.exe
3012	Unicorn-5308.exe
2740	Unicorn-27775.exe
2544	Unicorn-28329.exe
2056	Unicorn-64531.exe
2816	Unicorn-51822.exe
2764	Unicorn-36305.exe
2776	Unicorn-6970.exe
2296	Unicorn-21260.exe
2836	Unicorn-27391.exe
2684	Unicorn-27945.exe
2636	Unicorn-45818.exe
2432	Unicorn-40987.exe
2728	Unicorn-48890.exe
2516	Unicorn-36711.exe
1908	Unicorn-31665.exe
2096	Unicorn-7930.exe
408	Unicorn-26304.exe
1340	Unicorn-32435.exe
2720	Unicorn-12377.exe
768	Unicorn-12377.exe
1476	Unicorn-32243.exe
1308	Unicorn-32243.exe
1800	Unicorn-48579.exe
2644	Unicorn-64405.exe
2088	Unicorn-57521.exe
1092	Unicorn-34141.exe
752	Unicorn-29166.exe
2240	Unicorn-46057.exe
2624	Unicorn-53670.exe
2528	Unicorn-29528.exe
1784	Unicorn-49394.exe

Loads dropped DLL 64 IoCs

pid	Process
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2584	Unicorn-22658.exe
2584	Unicorn-22658.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2804	Unicorn-15689.exe
2804	Unicorn-15689.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2868	Unicorn-20327.exe
2584	Unicorn-22658.exe
2868	Unicorn-20327.exe
2584	Unicorn-22658.exe
2668	Unicorn-32191.exe
2668	Unicorn-32191.exe
2804	Unicorn-15689.exe
2804	Unicorn-15689.exe
2828	Unicorn-52611.exe
2828	Unicorn-52611.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2868	Unicorn-20327.exe
2584	Unicorn-22658.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2884	Unicorn-46481.exe
2584	Unicorn-22658.exe
2708	Unicorn-32745.exe
2884	Unicorn-46481.exe
2708	Unicorn-32745.exe
2868	Unicorn-20327.exe
3056	Unicorn-53846.exe
3056	Unicorn-53846.exe
2668	Unicorn-32191.exe
2668	Unicorn-32191.exe
3032	Unicorn-39408.exe
3032	Unicorn-39408.exe
2520	Unicorn-30494.exe
2804	Unicorn-15689.exe
2520	Unicorn-30494.exe
2804	Unicorn-15689.exe
2828	Unicorn-52611.exe
2828	Unicorn-52611.exe
1692	Unicorn-47385.exe
1692	Unicorn-47385.exe
268	Unicorn-1713.exe
2868	Unicorn-20327.exe
268	Unicorn-1713.exe
2868	Unicorn-20327.exe
2884	Unicorn-46481.exe
2884	Unicorn-46481.exe
2584	Unicorn-22658.exe
608	Unicorn-1448.exe
2584	Unicorn-22658.exe
608	Unicorn-1448.exe
2560	Unicorn-1713.exe
2560	Unicorn-1713.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2708	Unicorn-32745.exe
2708	Unicorn-32745.exe
816	Unicorn-5844.exe
816	Unicorn-5844.exe
3056	Unicorn-53846.exe
1752	Unicorn-59684.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4060	3680	WerFault.exe	224

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42516.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
2584	Unicorn-22658.exe
2804	Unicorn-15689.exe
2868	Unicorn-20327.exe
2668	Unicorn-32191.exe
2884	Unicorn-46481.exe
2708	Unicorn-32745.exe
2828	Unicorn-52611.exe
3056	Unicorn-53846.exe
3032	Unicorn-39408.exe
2520	Unicorn-30494.exe
288	Unicorn-61120.exe
2560	Unicorn-1713.exe
268	Unicorn-1713.exe
1692	Unicorn-47385.exe
608	Unicorn-1448.exe
816	Unicorn-5844.exe
1752	Unicorn-59684.exe
584	Unicorn-3104.exe
2100	Unicorn-56197.exe
2372	Unicorn-50067.exe
2052	Unicorn-39154.exe
1632	Unicorn-30240.exe
3036	Unicorn-64950.exe
2648	Unicorn-5543.exe
1732	Unicorn-3550.exe
1452	Unicorn-35668.exe
1920	Unicorn-35403.exe
992	Unicorn-31584.exe
1668	Unicorn-47158.exe
2632	Unicorn-40306.exe
3040	Unicorn-11630.exe
2524	Unicorn-7354.exe
1624	Unicorn-28521.exe
3012	Unicorn-5308.exe
2544	Unicorn-28329.exe
2056	Unicorn-64531.exe
2816	Unicorn-51822.exe
2764	Unicorn-36305.exe
2776	Unicorn-6970.exe
2836	Unicorn-27391.exe
2296	Unicorn-21260.exe
2684	Unicorn-27945.exe
2432	Unicorn-40987.exe
2636	Unicorn-45818.exe
2728	Unicorn-48890.exe
2516	Unicorn-36711.exe
1908	Unicorn-31665.exe
2096	Unicorn-7930.exe
408	Unicorn-26304.exe
1340	Unicorn-32435.exe
2720	Unicorn-12377.exe
768	Unicorn-12377.exe
1476	Unicorn-32243.exe
1308	Unicorn-32243.exe
1800	Unicorn-48579.exe
2644	Unicorn-64405.exe
2088	Unicorn-57521.exe
1092	Unicorn-34141.exe
752	Unicorn-29166.exe
2240	Unicorn-46057.exe
2624	Unicorn-53670.exe
1784	Unicorn-49394.exe
2528	Unicorn-29528.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2584	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	29
PID 2604 wrote to memory of 2584	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	29
PID 2604 wrote to memory of 2584	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	29
PID 2604 wrote to memory of 2584	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	29
PID 2584 wrote to memory of 2804	2584	Unicorn-22658.exe	30
PID 2584 wrote to memory of 2804	2584	Unicorn-22658.exe	30
PID 2584 wrote to memory of 2804	2584	Unicorn-22658.exe	30
PID 2584 wrote to memory of 2804	2584	Unicorn-22658.exe	30
PID 2604 wrote to memory of 2868	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	31
PID 2604 wrote to memory of 2868	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	31
PID 2604 wrote to memory of 2868	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	31
PID 2604 wrote to memory of 2868	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	31
PID 2804 wrote to memory of 2668	2804	Unicorn-15689.exe	32
PID 2804 wrote to memory of 2668	2804	Unicorn-15689.exe	32
PID 2804 wrote to memory of 2668	2804	Unicorn-15689.exe	32
PID 2804 wrote to memory of 2668	2804	Unicorn-15689.exe	32
PID 2604 wrote to memory of 2884	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	33
PID 2604 wrote to memory of 2884	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	33
PID 2604 wrote to memory of 2884	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	33
PID 2604 wrote to memory of 2884	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	33
PID 2868 wrote to memory of 2828	2868	Unicorn-20327.exe	34
PID 2868 wrote to memory of 2828	2868	Unicorn-20327.exe	34
PID 2868 wrote to memory of 2828	2868	Unicorn-20327.exe	34
PID 2868 wrote to memory of 2828	2868	Unicorn-20327.exe	34
PID 2584 wrote to memory of 2708	2584	Unicorn-22658.exe	35
PID 2584 wrote to memory of 2708	2584	Unicorn-22658.exe	35
PID 2584 wrote to memory of 2708	2584	Unicorn-22658.exe	35
PID 2584 wrote to memory of 2708	2584	Unicorn-22658.exe	35
PID 2668 wrote to memory of 3056	2668	Unicorn-32191.exe	36
PID 2668 wrote to memory of 3056	2668	Unicorn-32191.exe	36
PID 2668 wrote to memory of 3056	2668	Unicorn-32191.exe	36
PID 2668 wrote to memory of 3056	2668	Unicorn-32191.exe	36
PID 2804 wrote to memory of 3032	2804	Unicorn-15689.exe	37
PID 2804 wrote to memory of 3032	2804	Unicorn-15689.exe	37
PID 2804 wrote to memory of 3032	2804	Unicorn-15689.exe	37
PID 2804 wrote to memory of 3032	2804	Unicorn-15689.exe	37
PID 2828 wrote to memory of 2520	2828	Unicorn-52611.exe	38
PID 2828 wrote to memory of 2520	2828	Unicorn-52611.exe	38
PID 2828 wrote to memory of 2520	2828	Unicorn-52611.exe	38
PID 2828 wrote to memory of 2520	2828	Unicorn-52611.exe	38
PID 2604 wrote to memory of 608	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	39
PID 2604 wrote to memory of 608	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	39
PID 2604 wrote to memory of 608	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	39
PID 2604 wrote to memory of 608	2604	dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe	39
PID 2584 wrote to memory of 288	2584	Unicorn-22658.exe	41
PID 2584 wrote to memory of 288	2584	Unicorn-22658.exe	41
PID 2584 wrote to memory of 288	2584	Unicorn-22658.exe	41
PID 2584 wrote to memory of 288	2584	Unicorn-22658.exe	41
PID 2884 wrote to memory of 268	2884	Unicorn-46481.exe	42
PID 2884 wrote to memory of 268	2884	Unicorn-46481.exe	42
PID 2884 wrote to memory of 268	2884	Unicorn-46481.exe	42
PID 2884 wrote to memory of 268	2884	Unicorn-46481.exe	42
PID 2708 wrote to memory of 2560	2708	Unicorn-32745.exe	43
PID 2708 wrote to memory of 2560	2708	Unicorn-32745.exe	43
PID 2708 wrote to memory of 2560	2708	Unicorn-32745.exe	43
PID 2708 wrote to memory of 2560	2708	Unicorn-32745.exe	43
PID 2868 wrote to memory of 1692	2868	Unicorn-20327.exe	40
PID 2868 wrote to memory of 1692	2868	Unicorn-20327.exe	40
PID 2868 wrote to memory of 1692	2868	Unicorn-20327.exe	40
PID 2868 wrote to memory of 1692	2868	Unicorn-20327.exe	40
PID 3056 wrote to memory of 816	3056	Unicorn-53846.exe	44
PID 3056 wrote to memory of 816	3056	Unicorn-53846.exe	44
PID 3056 wrote to memory of 816	3056	Unicorn-53846.exe	44
PID 3056 wrote to memory of 816	3056	Unicorn-53846.exe	44

C:\Users\Admin\AppData\Local\Temp\dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe
"C:\Users\Admin\AppData\Local\Temp\dd7acab4dd0fbef7268ebc3d9e9087311656f1476442cfd935ebae90544743bd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4378.exe
        9⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40169.exe
        9⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        9⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        9⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        9⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        9⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        8⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
        8⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62074.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        7⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29908.exe
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        8⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        7⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        6⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26657.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        6⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        6⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        8⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40886.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        8⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        7⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        7⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        6⤵
        
        PID:280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        6⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        7⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32601.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        6⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        6⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        5⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        5⤵
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39408.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
        6⤵
        Executes dropped EXE
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe
        8⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe
        8⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65057.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24421.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40494.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        7⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        7⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        8⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        7⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        6⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63224.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        6⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17062.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        7⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7779.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19226.exe
        6⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35924.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
        7⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        6⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57061.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        5⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46801.exe
        5⤵
        
        PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64531.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41034.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        7⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        6⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
        6⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        6⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        5⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        5⤵
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25198.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        6⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        5⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        5⤵
        
        PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
      4⤵
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2025.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
      4⤵
      PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        7⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        6⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        6⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49624.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65528.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        7⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        6⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        6⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13764.exe
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        5⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        6⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        5⤵
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        6⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        6⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        5⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        6⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        5⤵
        
        PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
      4⤵
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        5⤵
        
        PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
      4⤵
      PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20942.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
      4⤵
      PID:7764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        5⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
        6⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        5⤵
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        5⤵
        
        PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
      4⤵
      PID:7808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35403.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe
        5⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        5⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        5⤵
        
        PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6453.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      4⤵
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      4⤵
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        5⤵
        
        PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
      4⤵
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
      4⤵
      PID:7292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
    3⤵
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe
      4⤵
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
      4⤵
      PID:7484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31050.exe
      4⤵
      PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40870.exe
      4⤵
      PID:7244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
    3⤵
    PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
    3⤵
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
    3⤵
    PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
    3⤵
    PID:1520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        7⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5141.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9848.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        6⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        6⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4552.exe
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        6⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30718.exe
        6⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 188
        7⤵
        Program crash
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7186.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        6⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        6⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        5⤵
        
        PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        6⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        6⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        5⤵
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49584.exe
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        5⤵
        
        PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        5⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        6⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        5⤵
        
        PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4000.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        5⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
      4⤵
      PID:616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18634.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
      4⤵
      PID:7272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46820.exe
        6⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        7⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        6⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        6⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        5⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
      4⤵
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50916.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60397.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
        5⤵
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exe
      4⤵
      PID:7900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
        5⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        5⤵
        
        PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5385.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
      4⤵
      PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
      4⤵
      PID:8132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48890.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
      4⤵
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63138.exe
      4⤵
      PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
      4⤵
      PID:7976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
    3⤵
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
      4⤵
      PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11854.exe
    3⤵
    PID:5864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
    3⤵
    PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
    3⤵
    PID:7204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
        6⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        5⤵
        
        PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        6⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5385.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
      4⤵
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37425.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42728.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49755.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
      4⤵
      PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
      4⤵
      PID:7928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        5⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
        6⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23173.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        5⤵
        
        PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
      4⤵
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        5⤵
        
        PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17423.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23523.exe
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
      4⤵
      PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1321.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
      4⤵
      PID:8176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
    3⤵
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
    3⤵
    PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
    3⤵
    PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10069.exe
    3⤵
    PID:7200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
        5⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6303.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        5⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        5⤵
        
        PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
      4⤵
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        5⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19438.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
      4⤵
      PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      4⤵
      PID:8144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34141.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
      4⤵
      PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46387.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25450.exe
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
      4⤵
      PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
      4⤵
      PID:7236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
    3⤵
    PID:664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
    3⤵
    PID:3656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
    3⤵
    PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
    3⤵
    PID:8000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47158.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41693.exe
      4⤵
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12090.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        5⤵
        
        PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
      4⤵
      PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
      4⤵
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
      4⤵
      PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34067.exe
      4⤵
      PID:7776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16911.exe
    3⤵
    PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
    3⤵
    PID:7572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56887.exe
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16444.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
      4⤵
      PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31666.exe
      4⤵
      PID:7840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe
    3⤵
    PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
    3⤵
    PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
    3⤵
    PID:7408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50651.exe
    3⤵
    PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
    3⤵
    PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
    3⤵
    PID:7524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59159.exe
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
  2⤵
  PID:6136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2389.exe
  2⤵
  PID:6228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
  2⤵
  PID:7592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-32191.exe

Filesize
468KB

MD5
2f8c7e4f5ea5a7df46d8ccc5b0895367

SHA1
7f28bba889d5d7027308bc6656564badf8f965ba

SHA256
60c06a49ced35938231b5f4acb9ecedc56c964e839685851017e53ba7afb29ac

SHA512
32a592c37807e0354a6c465da763dd917f261228923fbc9bfb3a54964e804ee900666d0d17de195993400826bf4bc70be78d0c042a67b5278506c0fb10af17bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe

Filesize
468KB

MD5
aa9cf64ee15dd0292dc43f30757e3ebb

SHA1
21b852eace7aa4843821a82c90f4b06681db7b77

SHA256
53850f1b9ae0c56d16b6a4f9a913646657488a6d7bb24584a282e8e944b8aa35

SHA512
f694fd5dc025f4981152decdede59742f44fc09e178729d13016db8ab4a75b5d5ae0a9ec181907594cdb6ced169986cf2db8ca3c9ca02305e2b9690d0225e63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46481.exe

Filesize
468KB

MD5
d5b7fc2d6216be15bb99e6321ba34ff0

SHA1
010ec957d9cbfa4808e1346d9379dc371f9fe4c0

SHA256
c7a760f1a31307b233187d4f8eb53c89dc1c950aa8a558d83b68524cdc46eca8

SHA512
5ae220af593bda58940ca377620164868f9fd0b07c32270deb9e85b4853d927595876047a52fc88acb8f9215727891ffdd72b30bedd204f7fb858464ce1db2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe

Filesize
468KB

MD5
572c1b006e46d04e14c6415123e3025e

SHA1
ffe6d68da9a814e9aca4aff3c12b226491eb7da9

SHA256
3a6c4c04167d41f4b5c0e9534eeb828f5df70e476c76b7bdd01432b08a3891ac

SHA512
f60d5c4fe685cc12c176a93ec2979b9f42e2aebb80249307ac2431fff9b055a6a60717a2d5fbd0b5a5888fc6ad4c5c9374e944a562c6de9249e5b4c24e4b5195

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe

Filesize
468KB

MD5
3496e3c32231b8ebec4c3eba2c69c71f

SHA1
5a780dd70312952b4d23cf4f21ea543632de921c

SHA256
36462fcbef74e3fb433a91c9389834cbc4effa118a9b44b00203f3581cb9c4bc

SHA512
11bf8a6dd8bd654bb1af9c4eee962e48fde69614d90d30c23ca68a8200e7d2ce8c6566354da9b72c12010bda967241c4e182f1d610d66b0c659efa5513a43e17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe

Filesize
468KB

MD5
31d87c4083e0ace092d06b029f590fda

SHA1
f47533f4635ba3b95e7628d4cad9e09f08f295b9

SHA256
6d9122558f19f1694c6f4cb822c72421bd9fa15d346ea0b2e263d1532b9bd39c

SHA512
d231e53309c335ba5666f931706642306e06ceac25d1a4a5a68d65c9a986e1cbc28293dfbe0ca6936d960118fb04a5667a34d86852b20966156b9e2dca2e9ba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe

Filesize
468KB

MD5
44b4bcfcdcf8384b5f9d3479df18b866

SHA1
22e307ae35c716b6c686a1ea2e5cbcce74c321da

SHA256
5a8c1b28cdbefee943c497fa2a75b43fcdf5c7f3c0545f426138325cb8ed19fe

SHA512
723926e4bda665cb435107f5549ddd01c5a1ab99135688b1770f97c425bf74ecf64d5fde318c0443a1c0232c3633349f80447cc7e5659dedf0aa3d4092379efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe

Filesize
468KB

MD5
e2b009e56d7b22f172105a67e1894d9b

SHA1
f8a599e41b824cf87e372167d858fa4c060f853e

SHA256
e34952f12a9a51364e541c0d59294bdf8c72ef0420a7498702a0110602afa9e9

SHA512
0fabb155e8b30d0d8a6459f32f4246dfc61a7c5377a7e738fda1149e607ea199a624565d048593c32314563ba9c75fae7175e5e9cfb23acd684030385c07005c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe

Filesize
468KB

MD5
bb4a542e4f9e84b4eec9b29a0a857edd

SHA1
0a72f423b9663e3d4b3abbc68dc36bb249f893d8

SHA256
54e80a961313735fabba69165577789940165b73ccbbbe07f81724bafa5ccfb5

SHA512
9f79dfd7f358e72a6a018d52a83506b0e7e764e116b2cb07fbc359f8e39a16027a3200c31fdf026199c53155e7be73286e50ca5d74a791472ee92554adacc145

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe

Filesize
468KB

MD5
fe3f2b545766eb796466cf7d489402bf

SHA1
191538744b5988c5fdf74e126b7504d6406cb00c

SHA256
8750068ba76ac544a7f39edeb49368865bd9324abf67d9178b95b154cd8a06f9

SHA512
64ff8361e451001886564c4c3a1170e5574716bccadd9b175235981db24eb12613c6c4a034977c6d67b9c8e6558172b4cf84fbcb7c37f1a5f285fa1af234b18a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe

Filesize
468KB

MD5
f8639e014083e19df3780f3db997f50a

SHA1
897a8337382f47a521a426a2cdaadb131b69e725

SHA256
e4ec6e04b0154d29ed1ef5fea6669da74d0b98d5be8604e927ce710f5425763c

SHA512
54879070e3293d6f31d8ed3ade07ed52ba5cddf2edfcd1b6ce448ab64614ae1547704b82fbcc6d8e5648b84d1a3c6eddb78269157bf25330f1fd9d549d070f1c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe

Filesize
468KB

MD5
2c0660db4627517c7b37a7eb4efafeaf

SHA1
0f1a2ea6004989917836f564fc830f09cff279d0

SHA256
c350f8e3757161a412791a4dd590b82d0466ac0f2efd95ae90aae57950f34090

SHA512
dbbb830acca259018528f65753979ae28843f788ed303bc9ffe41c94070c3119ec158b30b91e711dae20fe383ac23b9007778b0ded95d59e3ef1bec2f5dd5dcb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe

Filesize
468KB

MD5
4ab420d6e63e779d30a9e69bf6e4759a

SHA1
8031804e6bff12bb68b2697da8574977ee89d1ac

SHA256
79a5fe355bf51df4baa74f57853c6695ed855b1b28bfff628022c81bc5a6f35b

SHA512
15576761c528bf373b238fcaad849c7ee37fa287ab5999c5e87e68c5e303c5b4c487a6ba1b6152907d9afc1c1b659b2522a46fc1ee73ac08eb77b61bbe03a99f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe

Filesize
468KB

MD5
e3ef3e646740558df77dba23588277e8

SHA1
d0c953751d8905f736fbcec3f7d13ebc3488bd65

SHA256
b9f11eaf0343053239cb3f2463b504a1624c6eeb660126878e5f1c7090f1c5d5

SHA512
ddd1ca225290482d8474189fb8f1dde47b5ef435a9acbfe7db3197c13ba26b57734c87d8861dd01e33008c05ba9c64518657cc22bd76f22316e2f30d8513c74c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe

Filesize
468KB

MD5
f78d35d751c0326e2566cca35b1cabce

SHA1
06820ca1a9a588b4e3074885065a7035bbdc3fc8

SHA256
2b7721a5627a2f0abe78b005fbffaa0515f1efe3b5dddd1f6dde86fec82f57c7

SHA512
935571f26cb98c11a0433395caefd271a9839ad79f6178b43642dd92a4f8a4122c97e1a9dfac9ed4c7e25b2f7e2d2a841ac8d4556ea0a2094c253f297d7ceb23

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39408.exe

Filesize
468KB

MD5
f8f9ad7f25bfc127a06bde10afba3231

SHA1
86ef2b2d77bbccdf8656646444282b4c2f33f9be

SHA256
361fdd2c4bef4f61d2033c84155030b3480c1d8f86996b30316d8462d14d4632

SHA512
cae0da5ef885795ea2b1993b967a62f484dd8fec7f0faaa8738addbddeb8e50e42be6593b4356c5ed1f955594022089674836746ca76e7b30af8ab53bdff5316

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe

Filesize
468KB

MD5
5e2181480dfd9dfaa840ebdcbd84cd98

SHA1
e2ac0c0a0a9ce94ab7e4a3525314e6b06a789e68

SHA256
187f984d3eeb1d6ac3340124f5adac6e3aaf5677e905729e467a85ae84027bc9

SHA512
34fd43f68de2541be884a0722ad6527ef5ba0a87def3843d690d2128924ff1d71e391614b7fd5ef19a539e206296af05b303a87e2fedd3d9f6a4ab61ae9b3fb6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe

Filesize
468KB

MD5
4d8108da075d754e0fed309f2f4b795c

SHA1
c9f974e182ef99f2c743bb4683c781bf1ba6e5af

SHA256
30af155d2c40a0a57a2b05dccfe5ede03f3670d771c66e763a770a5ca502a3c6

SHA512
64de466066fe815edc28d33a879aa767f13725272cc9e0849909be9e5d53115fce595b15159c0d1c83661968d0262198f93f37d91a8922f6a55a07040ff262e7

Download Submit